cicy-desktop 2.1.278 → 2.1.280

package/.github/workflows/linux-app-release.yml

@@ -73,6 +73,13 @@ jobs:
           CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           set -euo pipefail
+          if [ "$GITHUB_REF_TYPE" = "tag" ]; then
+            for attempt in $(seq 1 60); do
+              gh release view "$GITHUB_REF_NAME" --repo "${{ github.repository }}" >/dev/null 2>&1 && break
+              [ "$attempt" -eq 60 ] && { echo "::error::release was not created by the Windows workflow within 5 minutes"; exit 1; }
+              sleep 5
+            done
+          fi
           npm run build:linux -- --x64 --config.linux.target=AppImage --config.publish.owner="$PUBLISH_OWNER" --config.publish.repo="$PUBLISH_REPO" --publish always
 
       # AppImage + 版本指针传到 OSS —— app-updater 现已全走 OSS(不碰 GitHub),linux 也要在

package/.github/workflows/mac-app-release.yml

@@ -133,17 +133,21 @@ jobs:
           echo "version=${version}" >> "$GITHUB_OUTPUT"
           echo "tag=v${version}" >> "$GITHUB_OUTPUT"
 
-      - name: Ensure draft GitHub release exists
+      - name: Wait for Windows workflow to create the GitHub release
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release create "${{ steps.meta.outputs.tag }}" \
-            --repo "${{ github.repository }}" \
-            --title "CiCy Desktop v${{ steps.meta.outputs.version }}" \
-            --generate-notes \
-            --draft \
-            2>/dev/null || echo "release already exists, continuing"
+          if [ "$GITHUB_REF_TYPE" != "tag" ]; then
+            gh release create "${{ steps.meta.outputs.tag }}" --repo "${{ github.repository }}" --title "CiCy Desktop v${{ steps.meta.outputs.version }}" --generate-notes --draft 2>/dev/null || true
+            exit 0
+          fi
+          for attempt in $(seq 1 60); do
+            gh release view "${{ steps.meta.outputs.tag }}" --repo "${{ github.repository }}" >/dev/null 2>&1 && exit 0
+            sleep 5
+          done
+          echo "::error::release was not created by the Windows workflow within 5 minutes"
+          exit 1
 
       - name: Build and publish PKG installers
         shell: bash

package/.github/workflows/npm-publish.yml

@@ -15,7 +15,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # 单元测试(node:test,零依赖)。发布前必过 —— 这些用例守的是 WSL/Docker sidecar 那条
+  # 只在 Windows 真机上才跑得到的路径,本地很难复现,只能靠断言兜住。
+  # Node 22:`node --test "<glob>"` 的 glob 展开是 node ≥21 的能力(20 只认目录参数)。
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run tests
+        run: npm test
+
   publish:
+    needs: test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

package/docs/superpowers/plans/2026-08-23-electron-inject-installer.md

@@ -0,0 +1,79 @@
+# Electron Inject Installer Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a restricted Desktop RPC and public `agent-electron` CLI that install JavaScript into `~/data/electron/extension/inject/`.
+
+**Architecture:** Desktop owns path validation and atomic host writes through one `electron_inject` tool. The public Skill reads a caller-provided source file and forwards its UTF-8 content without printing it.
+
+**Tech Stack:** Electron/Node.js CommonJS Desktop tools, Zod schemas, Node test runner, ESM public Skill CLI.
+
+**Spec:** `docs/superpowers/specs/2026-08-23-electron-inject-installer-design.md`
+
+## Global Constraints
+
+- Fixed Desktop root: `path.join(os.homedir(), "data", "electron", "extension", "inject")`.
+- Accept only filenames matching `^[a-z0-9][a-z0-9._-]*\.js$`.
+- Reject payloads larger than 1 MiB and never return JavaScript content.
+- Use atomic sibling-temp write, mode `0600`, and SHA-256 verification.
+- Do not use the existing arbitrary-path `file_write` tool.
+
+---
+
+### Task 1: Desktop `electron_inject` RPC
+
+**Files:**
+- Create: `src/tools/electron-inject-tools.js`
+- Modify: `src/tools/index.js`
+- Modify: `src/utils/rpc-guard.js`
+- Test: `test/electron-inject-tools.test.js`
+
+**Interfaces:**
+- Consumes: `{operation:"install"|"status"|"uninstall", name:string, content?:string}`.
+- Produces: `{operation,name,path,exists,size,sha256}` encoded in the standard tool text envelope.
+
+- [ ] Write tests registering the tool with `CICY_ELECTRON_INJECT_DIR` set to a temporary directory. Assert install, status, replacement, mode `0600`, SHA-256, uninstall, traversal rejection, extension rejection, symlink rejection, and the 1 MiB limit.
+- [ ] Run `node --test test/electron-inject-tools.test.js` and confirm RED because the tool does not exist.
+- [ ] Implement `electron-inject-tools.js` with exported validation helpers and `registerTools`; resolve and realpath-check the fixed root, use `openSync(temp,"wx",0o600)`, `writeFileSync`, `renameSync`, and clean the temp on errors.
+- [ ] Register it in `src/tools/index.js` and add `electron_inject` to the RPC guard's host-write list.
+- [ ] Run the focused test, full `node --test test/*.test.js`, and `git diff --check`.
+- [ ] Commit, fetch/rebase, and push `cicy-ai/cicy-desktop` `main`.
+
+### Task 2: Public `agent-electron inject` CLI
+
+**Files:**
+- Modify: `skills/agent-electron/bin/agent-electron`
+- Modify: `skills/agent-electron/manifest.json`
+- Modify: `skills/agent-electron/SKILL.md`
+- Modify: `skills/agent-electron/README.md`
+- Modify: `skills/agent-electron/references/help.md`
+- Modify: `skills/agent-electron/references/help.en.md`
+- Modify: `skills/agent-electron/references/help.cn.md`
+- Modify: `skills/agent-electron/references/tools.md`
+- Modify: `skills/agent-electron/references/tools.en.md`
+- Modify: `skills/agent-electron/references/tools.cn.md`
+- Modify: `skills/agent-electron/test/test.js`
+
+**Interfaces:**
+- Consumes: `inject install <name> --source <file>`, `inject status <name>`, and `inject uninstall <name>`.
+- Produces: the unwrapped `electron_inject` Desktop result with no source content in stdout/stderr.
+
+- [ ] Add CLI tests using a temporary source containing a sentinel secret and a fake local cicy-code HTTP server. Assert the RPC payload selects `electron_inject`, forwards content, and output never contains the sentinel.
+- [ ] Run `node tools/test-skill.js skills/agent-electron` and confirm RED.
+- [ ] Add the `inject` dispatcher and parser. Require `--source` only for install, read UTF-8 with a 1 MiB pre-check, then call `rpc("electron_inject", payload)`.
+- [ ] Update help and metadata; bump `agent-electron` from `1.0.17` to `1.1.0` because this is backward-compatible functionality.
+- [ ] Run the Skill test, validator, sensitive-path scan, and `git diff --check`.
+- [ ] Commit, fetch/rebase, push `cicy-ai/cicy-skills` `main`, tag `agent-electron-v1.1.0`, and monitor the public release and registry.
+
+### Task 3: Integration verification
+
+**Files:**
+- Verify both repositories at remote `main`.
+
+**Interfaces:**
+- Consumes: a running new Desktop plus `agent-electron@1.1.0`.
+- Produces: local tests, releases, and registry evidence; live host installation only when a Desktop containing the new RPC is connected.
+
+- [ ] Re-run both focused/full suites from clean `main` checkouts.
+- [ ] Confirm Desktop commit is on remote `main`, Skill workflow succeeded, Release ZIP exists, and registry reports `agent-electron@1.1.0`.
+- [ ] If no updated Desktop is connected, report live installation as pending instead of claiming it ran.

package/docs/superpowers/plans/2026-08-24-telegram-matrix.md

@@ -0,0 +1,85 @@
+# Telegram Matrix Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Turn the `Telegram 矩阵` preset into a profile manager with a left-side profile table and a phone-sized Telegram Web preview on the right.
+
+**Architecture:** Keep the system profile panel as renderer chrome and place one main-process `BrowserView` above its preview slot. The selected item supplies `persist:sandbox-N`; profile creation and proxy changes go through `profile-store`, and the BrowserView is rebuilt/reloaded when its profile or proxy changes.
+
+**Tech Stack:** Electron BrowserView, IPC/contextBridge, CommonJS, HTML/CSS/JavaScript, Node test runner.
+
+**Spec:** Approved in chat on 2026-08-24: unlimited Electron profiles, one item per profile, custom per-profile proxy, phone-sized Telegram preview.
+
+## Global Constraints
+
+- Ordinary `面板` behavior remains unchanged.
+- Telegram profile data uses `persist:sandbox-<accountIdx>` and existing `~/data/electron/account-<N>.json` persistence.
+- New profiles default to `http://127.0.0.1:20001`; each profile can use a custom `http://`, `https://`, or `socks5://` proxy, or direct mode.
+- The Telegram target is `https://web.telegram.org/k/`.
+- Profile 0 and reserved profile 9 must not appear in the matrix.
+
+---
+
+### Task 1: Matrix preset routing
+
+**Files:**
+- Modify: `src/tabbrowser/panel-presets.js`
+- Modify: `src/tools/tab-browser-tools.js`
+- Modify: `src/tabbrowser/newtab-protocol.js`
+- Create: `src/tabbrowser/telegram-matrix.html`
+- Test: `test/telegram-matrix.test.js`
+
+**Interfaces:**
+- Produces: `resolvePanelPreset("telegram-matrix")` with a `query` field; `cicyui://panel/<id>?preset=telegram-matrix` serves `telegram-matrix.html`.
+
+- [ ] Write a failing test asserting the Telegram preset URL query and dedicated HTML routing contract.
+- [ ] Run `node --test test/telegram-matrix.test.js` and confirm the missing query/page behavior fails.
+- [ ] Add the preset query, append it in `openPanelTab`, and select `telegram-matrix.html` in the protocol handler.
+- [ ] Run the test and confirm it passes.
+
+### Task 2: Profile creation and custom proxy service
+
+**Files:**
+- Create: `src/tabbrowser/telegram-matrix-profiles.js`
+- Modify: `src/tabbrowser/panel-cells.js`
+- Modify: `src/tabbrowser/panel-preload.js`
+- Test: `test/telegram-matrix.test.js`
+
+**Interfaces:**
+- Produces: `listTelegramProfiles()`, `addTelegramProfile(defaultProxy)`, `setTelegramProfileProxy(accountIdx, proxy)`.
+- IPC: `panelcells:profiles`, `panelcells:add-profile`, `panelcells:set-profile-proxy`.
+
+- [ ] Write failing tests for next-ID allocation, default proxy persistence, accepted proxy schemes, direct mode, and invalid proxy rejection.
+- [ ] Run the focused test and confirm each new behavior fails for the expected reason.
+- [ ] Implement the pure validation/allocation service and IPC handlers backed by `profile-store`.
+- [ ] Apply proxy immediately with `session.setProxy`, rebuild the selected profile view when needed, and expose methods through `panelAPI`.
+- [ ] Run focused and profile-store tests and confirm they pass.
+
+### Task 3: Table and phone preview UI
+
+**Files:**
+- Modify: `src/tabbrowser/telegram-matrix.html`
+- Test: `test/telegram-matrix.test.js`
+
+**Interfaces:**
+- Consumes: `panelAPI.profiles()`, `panelAPI.addProfile()`, `panelAPI.setProfileProxy()`, and `panelAPI.sync([{ id: "telegram-preview", url, profile, rect }])`.
+
+- [ ] Write a failing DOM-contract test for the profile table, add button, proxy editor, empty state, and phone preview slot.
+- [ ] Run the test and confirm the absent controls fail.
+- [ ] Implement rendering, first-profile selection, add-profile flow, per-row proxy editing, status feedback, and a single responsive 390-by-844 preview slot.
+- [ ] Sync only the selected profile to the native BrowserView and preserve the list selection locally.
+- [ ] Run the focused test and confirm it passes.
+
+### Task 4: Integration verification
+
+**Files:**
+- Test: `test/panel-launcher.test.js`
+- Test: `test/telegram-matrix.test.js`
+
+**Interfaces:**
+- Verifies the complete menu-to-matrix flow without changing ordinary panels.
+
+- [ ] Run `node --test test/panel-launcher.test.js test/telegram-matrix.test.js`.
+- [ ] Run syntax checks for every changed JavaScript file and `git diff --check`.
+- [ ] Restart `C:\projects\start-cicy-desktop-win.bat` and wait for the source Electron client to reconnect.
+- [ ] Open `Telegram 矩阵`, inspect its DOM via `agent-electron`, and confirm profile selection produces one Telegram BrowserView in the selected partition.

package/docs/superpowers/specs/2026-08-23-electron-inject-installer-design.md

@@ -0,0 +1,45 @@
+# Electron Inject Installer Design
+
+## Goal
+
+Allow a Skill running outside the desktop host, including inside WSL Docker, to install and manage an Electron Desktop Client injection script at:
+
+```text
+~/data/electron/extension/inject/telegram.org.js
+```
+
+The interface must not expose arbitrary host filesystem writes.
+
+## Desktop Tool
+
+Add an `electron_inject` RPC tool with three operations:
+
+- `install`: accept a safe filename and UTF-8 JavaScript content, write it atomically, set file mode `0600`, and return path, byte size, and SHA-256.
+- `status`: return existence, path, byte size, and SHA-256 without returning file content.
+- `uninstall`: remove the named file and report whether it existed.
+
+Resolve the root from `os.homedir()` plus `data/electron/extension/inject`. Accept only a basename matching `^[a-z0-9][a-z0-9._-]*\.js$`; reject separators, traversal, symlinks, non-JavaScript names, and targets outside the fixed root. Write to a temporary sibling with exclusive creation, rename atomically, and reject payloads larger than 1 MiB.
+
+Register the tool in the normal Desktop tool catalog and classify it as a guarded host-write operation. Audit logging remains handled by the existing RPC guard.
+
+## Public Skill Interface
+
+Extend the public `agent-electron` Skill with:
+
+```text
+agent-electron inject install telegram.org.js --source <file>
+agent-electron inject status telegram.org.js
+agent-electron inject uninstall telegram.org.js
+```
+
+The CLI reads `--source` locally, sends content through the Desktop RPC, and never prints content. `install` requires an explicit source file; no WSL Hook or generated placeholder is substituted for the Mac injection script. JSON output preserves Desktop path, size, and SHA-256.
+
+## Testing
+
+- Desktop unit tests use a temporary home/root override and prove fixed-root resolution, safe-name validation, traversal rejection, size limit, atomic replacement, hash reporting, mode `0600`, status, and uninstall.
+- `agent-electron` tests use a fake RPC transport and prove argv parsing, source reading, content forwarding without output leakage, stable JSON, and error handling.
+- Existing Desktop and Skill suites must remain green.
+
+## Release
+
+Commit and push Desktop independently after its tests pass. Then bump and publish `agent-electron` with a tag-driven public Skill release. A Desktop application release is a separate explicit step because packaging and distributing a new Desktop binary affects all clients.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.278",
+  "version": "2.1.280",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "scripts": {
     "start": "node ./bin/cicy-desktop",
+    "test": "node --test \"test/**/*.test.js\"",
     "start:master": "node src/master/master-main.js",
     "format": "prettier --write \"src/**/*.js\"",
     "format:check": "prettier --check \"src/**/*.js\"",
@@ -143,10 +144,10 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.563",
-    "cicy-code-darwin-arm64": "2.3.563",
-    "cicy-code-linux-x64": "2.3.563",
-    "cicy-code-linux-arm64": "2.3.563",
+    "cicy-code-darwin-x64": "2.3.568",
+    "cicy-code-darwin-arm64": "2.3.568",
+    "cicy-code-linux-x64": "2.3.568",
+    "cicy-code-linux-arm64": "2.3.568",
     "cicy-code-windows-x64": "2.3.193",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",

package/src/backends/docker-audit.js

@@ -0,0 +1,17 @@
+function createDockerAuditRecord(channel, event, args = {}) {
+  return {
+    ts: new Date().toISOString(),
+    channel,
+    webContentsId: event?.sender?.id ?? null,
+    senderUrl: event?.senderFrame?.url || event?.sender?.getURL?.() || "",
+    args,
+  };
+}
+
+function auditDestructiveIpc(log, channel, event, args = {}) {
+  const record = createDockerAuditRecord(channel, event, args);
+  log.warn(`[docker-audit] ${JSON.stringify(record)}`);
+  return record;
+}
+
+module.exports = { createDockerAuditRecord, auditDestructiveIpc };

package/src/backends/homepage-preload.js

@@ -178,6 +178,8 @@ contextBridge.exposeInMainWorld("cicy", {
     appUpdate:    ()  => logInvoke("docker:app-update"),
     appStop:      ()  => logInvoke("docker:app-stop"),
     appUpgrade:   ()  => logInvoke("docker:app-upgrade"),
+    getProtect:   ()  => logInvoke("docker:get-protect"),           // 容器保护开关(默认开)
+    setProtect:   (on) => logInvoke("docker:set-protect", !!on),
     getPorts:     ()  => logInvoke("docker:get-ports"),               // 读已发布的额外端口
     setPorts:     (ports) => logInvoke("docker:set-ports", { ports }), // 存端口 + recreate 带 -p
     // Open :8008 with the live container token (refuses if it can't read it).

package/src/backends/sidecar-ipc.js

@@ -20,6 +20,9 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const log = require("electron-log");
+const { auditDestructiveIpc } = require("./docker-audit");
+const { nextGatewayKeyHealth } = require("../sidecar/gateway-key-health");
+const dockerProtect = require("../sidecar/docker-protect"); // 容器保护开关(默认开)
 // Background-computed docker status lives here; the homepage READS this (never
 // probes WSL live → never blocks the UI / strands it on 「重试检测」).
 const DOCKER_STATUS_FILE = path.join(os.homedir(), "cicy-ai", "db", "docker-status.json");
@@ -137,6 +140,8 @@ function register({ sidecarLogPath } = {}) {
   // docker:app-status handler just returns the cache — instant, never blocks.
   let _dockerStatusCache = null;
   let _dockerDaemonBusy = false;
+  let _gatewayKeyMissingChecks = 0;
+  let _autostartEnsured = false;
   async function refreshDockerStatus() {
     try {
       const s = await appDocker.status(APP_PORT); // { wsl, distro, engineUp, running, unknown }
@@ -183,14 +188,31 @@ function register({ sidecarLogPath } = {}) {
         // 数据保留)。mac/win 同一套(hasGatewayKey 两个 docker 模块都实现了)。
         try {
           const opts = await appOpts();
-          if (opts.env && opts.env.CICY_AI_GATEWAY_LLM_API_KEY && appDocker.hasGatewayKey
-              && !(await appDocker.hasGatewayKey(APP_CONTAINER))) {
-            log.info("[docker-daemon] 容器在跑但没网关 key → 带 key 重建(数据保留)");
-            await appDocker.recreate(opts);
-            try { await registerAppTeam(); } catch {}
-            await refreshDockerStatus();
+          if (opts.env && opts.env.CICY_AI_GATEWAY_LLM_API_KEY && appDocker.hasGatewayKey && dockerProtect.isProtected()) {
+            _gatewayKeyMissingChecks = 0; // 容器保护:绝不因缺 key 自动重建;用户可从卡片菜单手动「重建」
+          } else if (opts.env && opts.env.CICY_AI_GATEWAY_LLM_API_KEY && appDocker.hasGatewayKey) {
+            const keyState = await appDocker.hasGatewayKey(APP_CONTAINER);
+            const health = nextGatewayKeyHealth(_gatewayKeyMissingChecks, keyState);
+            _gatewayKeyMissingChecks = health.missingChecks;
+            if (!health.shouldRecreate) {
+              if (keyState === false) log.warn(`[docker-daemon] 网关 key 明确缺失 (${_gatewayKeyMissingChecks}/3)，暂不重建`);
+            } else {
+              log.warn("[docker-daemon] 网关 key 连续 3 次明确缺失 → 带 key 重建(数据保留)");
+              auditDestructiveIpc(log, "docker:self-heal-missing-gateway-key", null, {
+                container: APP_CONTAINER,
+                confirmedMissingChecks: 3,
+              });
+              await appDocker.recreate(opts);
+              try { await registerAppTeam(); } catch {}
+              await refreshDockerStatus();
+            }
           }
         } catch (e) { log.warn(`[docker-daemon] key self-heal failed: ${e.message}`); }
+        // 开机自启链:每次会话确认一次登录任务 + wsl.conf [boot](幂等;老装机也能补上)。
+        if (!_autostartEnsured && appDocker.ensureAutostart) {
+          _autostartEnsured = true;
+          try { await appDocker.ensureAutostart(); } catch (err) { log.warn(`[docker-daemon] ensureAutostart failed: ${err.message}`); }
+        }
         // Chrome 代理:开关开着但宿主 mihomo 没跑 → 拉起(从容器同步配置,幂等)。
         try { await maybeStartChromeProxy(); } catch (e) { log.warn(`[chrome-proxy] auto-start failed: ${e.message}`); }
       }
@@ -214,12 +236,16 @@ function register({ sidecarLogPath } = {}) {
   // 已在跑也同步一次配置(容器侧节点可能被云端更新),变了才重启。幂等。二进制不在会自动下。
   async function maybeStartChromeProxy() {
     if (!APP_DOCKER_SUPPORTED) return;
-    const yaml = await appDocker.readMihomoConfig(APP_CONTAINER);
+    const [yaml, selections] = await Promise.all([
+      appDocker.readMihomoConfig(APP_CONTAINER),
+      appDocker.readMihomoSelections(APP_CONTAINER),
+    ]);
     if (hostMihomo.binPresent() && hostMihomo.running()) {
       if (hostMihomo.writeConfig(yaml)) hostMihomo.start({ force: true });
+      await hostMihomo.syncSelections(selections);
       return;
     }
-    await hostMihomo.enable({ containerYaml: yaml });
+    await hostMihomo.enable({ containerYaml: yaml, selections });
   }
 
   ipcMain.handle("sidecar:status", async () => {
@@ -464,10 +490,12 @@ function register({ sidecarLogPath } = {}) {
   // ⋯ menu → 重建 Docker:删容器 + 用新 env(docker team 网关 key)重新 docker run(保留
   // volume 数据)。换 key 的唯一途径。渲染端已 confirm。
   ipcMain.handle("docker:app-recreate", async (e) => {
+    auditDestructiveIpc(log, "docker:app-recreate", e);
     try {
       await ensureDockerTeam();
       await appDocker.recreate({
         ...(await appOpts()),
+        force: true, // 用户在卡片菜单明确点击并 confirm → 放行
         onProgress: (ev) => { try { e.sender.send("docker:app-progress", ev); } catch {} },
       });
       await registerAppTeam();
@@ -509,11 +537,13 @@ function register({ sidecarLogPath } = {}) {
 
   // ⋯ menu → 升级: re-pull the latest R2 image, re-create the :8008 container.
   ipcMain.handle("docker:app-upgrade", async (e) => {
+    auditDestructiveIpc(log, "docker:app-upgrade", e);
     if (!APP_DOCKER_SUPPORTED) return { ok: false, error: "Docker cicy-code 仅支持 Windows" };
     try {
       await ensureDockerTeam();
       const result = await appDocker.upgrade({
         ...(await appOpts()),
+        force: true, // 用户显式升级
         onProgress: (ev) => { try { e.sender.send("docker:app-progress", ev); } catch {} },
       });
       if (result && result.ok) await registerAppTeam();
@@ -524,18 +554,27 @@ function register({ sidecarLogPath } = {}) {
   });
 
   // 端口设置:读当前已发布的额外端口(:8008 固定,不在列)。
+  // 容器保护开关:开启时任何自动流程都不得 rm/recreate 容器或 wsl --shutdown。
+  ipcMain.handle("docker:get-protect", () => ({ ok: true, enabled: dockerProtect.isProtected() }));
+  ipcMain.handle("docker:set-protect", (e, on) => {
+    auditDestructiveIpc(log, "docker:set-protect", e, { enabled: !!on });
+    try { return { ok: true, enabled: dockerProtect.setProtected(!!on) }; } catch (err) { return { ok: false, error: err.message }; }
+  });
+
   ipcMain.handle("docker:get-ports", () => {
     return { ok: true, mainPort: APP_PORT, ports: readExtraPorts() };
   });
   // 保存端口 → 持久化 → recreate 容器带上新的 -p(:8008 + 各额外端口)。volume 保留。
   ipcMain.handle("docker:set-ports", async (e, input) => {
+    auditDestructiveIpc(log, "docker:set-ports", e, { ports: input?.ports });
     if (!APP_DOCKER_SUPPORTED) return { ok: false, error: "Docker cicy-code 仅支持 Windows" };
     const ports = sanitizePorts(input && input.ports);
     writeExtraPorts(ports);
     try {
       await ensureDockerTeam();
       const result = await appDocker.recreate({
-        ...(await appOpts()), // 已含 extraPorts: readExtraPorts()(刚写入的)
+        ...(await appOpts()),
+        force: true, // 用户显式改端口 // 已含 extraPorts: readExtraPorts()(刚写入的)
         onProgress: (ev) => { try { e.sender.send("docker:app-progress", ev); } catch {} },
       });
       await registerAppTeam();
@@ -655,11 +694,12 @@ function register({ sidecarLogPath } = {}) {
     try { return { ok: true, dood: sidecar.isDood() }; } catch (e) { return { ok: false, dood: false, error: e.message }; }
   });
   ipcMain.handle("sidecar:set-dood", async (e, on) => {
+    auditDestructiveIpc(log, "sidecar:set-dood", e, { enabled: !!on });
     const emit = (ev) => { try { e.sender.send("sidecar:op-progress", { op: "restart", ...ev }); } catch {} };
     try {
       sidecar.setDood(!!on);
       emit({ phase: "swap", status: "running", message: `容器 Docker 访问已${on ? "开启" : "关闭"},正在重建容器…` });
-      try { await appDocker.recreate({ ...(await appOpts()), onProgress: emit }); }
+      try { await appDocker.recreate({ ...(await appOpts()), force: true, onProgress: emit }); }
       catch (err) { try { await appDocker.dockerRestart?.({ onProgress: emit }); } catch {} }
       let up = false;
       for (let i = 0; i < 240; i++) { if ((await appDocker.probeHealth?.(PORT)) || (await sidecar.probeExisting(PORT))) { up = true; break; } await new Promise((r) => setTimeout(r, 500)); }

package/src/backends/webview-preload.js

@@ -24,7 +24,16 @@
 //   webview gets the awaited promise
 
 const { contextBridge, ipcRenderer } = require("electron");
-const { resolveReportedCicyTheme } = require("../tabbrowser/tab-theme");
+// NOTE: this preload runs in sandboxed renderers (<webview>, trusted popups),
+// where `require` only resolves Electron built-ins — a relative require of
+// ../tabbrowser/tab-theme aborts the whole preload. Keep the helper inline and
+// in sync with src/tabbrowser/tab-theme.js (covered by test/webview-preload.test.js).
+function normalizeCicyTheme(theme) {
+  return theme === "light" || theme === "dark" ? theme : null;
+}
+function resolveReportedCicyTheme(documentTheme, savedTheme) {
+  return normalizeCicyTheme(documentTheme) || normalizeCicyTheme(savedTheme) || "light";
+}
 
 // cicy-code owns the theme preference (`cicy_theme`) and publishes the applied
 // value on <html data-theme>. Report that contract to the owning tab window so

package/src/chrome/chrome-install-navigation.js

@@ -0,0 +1,23 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+const CHROME_INSTALL_URL = "https://www.google.com/chrome/";
+
+function isChromeBinaryMissingError(error) {
+  return /Chrome\/Chromium binary not found/i.test(String((error && error.message) || error || ""));
+}
+
+async function handleChromeLaunchError(error, { openInstallPage, showError }) {
+  if (isChromeBinaryMissingError(error)) {
+    await openInstallPage(CHROME_INSTALL_URL);
+    return true;
+  }
+  await showError(error);
+  return false;
+}
+
+module.exports = {
+  CHROME_INSTALL_URL,
+  handleChromeLaunchError,
+  isChromeBinaryMissingError,
+};

package/src/main.js

@@ -14,6 +14,7 @@ const { openWindowForBackend } = require("./backends/window-manager");
 const { Menu } = require("electron");
 const { dialog } = require("electron");
 const { setupAppIcons } = require("./tray");
+const { handleChromeLaunchError } = require("./chrome/chrome-install-navigation");
 const { brandHostElectron } = require("./utils/brand-host-electron");
 const appUpdater = require("./app-updater");
 
@@ -733,22 +734,31 @@ function ensureAutoLaunch() {
       // cicy-desktop bin) instead of process.execPath, which is a transient
       // electron path that breaks on every version/cache change (the old auto-
       // start bug). Skip a pure source checkout so devs aren't auto-added.
-      const installed = electronApp.isPackaged ||
-        __dirname.includes(`${path.sep}node_modules${path.sep}`);
-      if (!installed) return;
+      // 源码 checkout 也注册(要求:登录即自启 cicy-desktop → :8008)。applet 不存在时
+      // ensureMacLoginItem 自己会跳过并在下次重试。
       ensureMacLoginItem(want);
       return;
     }
 
-    // win/linux: unchanged — only manage login items for packaged builds.
-    if (!electronApp.isPackaged) return;
     if (process.platform === "win32") {
-      const cur = electronApp.getLoginItemSettings();
+      // 打包版:登录项指向自身 exe。源码运行(npm start):必须走 bin/cicy-desktop 启动器
+      // (它先起 master 再起 worker,直接起 electron.exe 会缺 master)。登录项指向一个
+      // wscript 隐藏启动的 VBS → `cmd /c node .\bin\cicy-desktop`,全程无控制台窗口。
+      const fromSource = !electronApp.isPackaged;
+      let opts;
+      if (fromSource) {
+        const vbs = writeSourceAutostartVbs();
+        opts = { openAtLogin: want, path: "wscript.exe", args: ["//B", "//Nologo", vbs] };
+      } else {
+        opts = { openAtLogin: want, args: ["--hidden"] };
+      }
+      const cur = electronApp.getLoginItemSettings(fromSource ? { path: opts.path, args: opts.args } : undefined);
       if (cur.openAtLogin !== want) {
-        electronApp.setLoginItemSettings({ openAtLogin: want, args: ["--hidden"] });
-        log.info(`[autostart] openAtLogin → ${want}`);
+        electronApp.setLoginItemSettings(opts);
+        log.info(`[autostart] openAtLogin → ${want}${fromSource ? ` (source: ${opts.path} ${opts.args.join(" ")})` : ""}`);
       }
     } else if (process.platform === "linux") {
+      if (!electronApp.isPackaged) return;
       ensureLinuxAutostart(want);
     }
   } catch (e) {
@@ -756,6 +766,24 @@ function ensureAutoLaunch() {
   }
 }
 
+// 源码模式 Windows 登录自启的隐藏启动器(VBS)。写到 %LOCALAPPDATA%\cicy-desktop,幂等覆盖。
+// 继承当前的 CICY_DEBUG(用 start-cicy-desktop-win.bat 起的就带 =1),其余环境用登录时的用户环境。
+function writeSourceAutostartVbs() {
+  const dir = path.join(process.env.LOCALAPPDATA || os.homedir(), "cicy-desktop");
+  fs.mkdirSync(dir, { recursive: true });
+  const vbs = path.join(dir, "autostart.vbs");
+  const appDir = electronApp.getAppPath();
+  const q = (s) => String(s).replace(/"/g, '""');
+  const lines = [
+    'Set sh = CreateObject("WScript.Shell")',
+    `sh.CurrentDirectory = "${q(appDir)}"`,
+  ];
+  if (process.env.CICY_DEBUG) lines.push(`sh.Environment("Process")("CICY_DEBUG") = "${q(process.env.CICY_DEBUG)}"`);
+  lines.push(`sh.Run "cmd /c node .\\bin\\cicy-desktop", 0, False`);
+  fs.writeFileSync(vbs, lines.join("\r\n") + "\r\n");
+  return vbs;
+}
+
 // mac login item pointing at the Desktop applet (~/Desktop/CiCy Desktop.app).
 // The applet is created by the launcher (bin/cicy-desktop ensureMacDesktopApp)
 // BEFORE electron spawns, so it exists by the time this runs. Idempotent:
@@ -1353,7 +1381,12 @@ electronApp.whenReady().then(async () => {
         accountIdx,
         activateIfRunning: true,
       });
-    } catch (e) { showProfileError("Chrome", e); }
+    } catch (e) {
+      await handleChromeLaunchError(e, {
+        openInstallPage: (url) => openElectronProfile(1, url),
+        showError: (error) => showProfileError("Chrome", error),
+      });
+    }
   };
   const openNativeChrome = () => {
     try { require("./tools/chrome-tools").launchNativeChrome(); }